Information & Communication Technology

• Governance
  Introduction Australian Standard International Standard Duty of Care Energy Imperative Electronic and Electrical Waste ICT Dispute Mediation Service Delivery over the Internet Build or Buy? Legal and Social issues of E-Commerce
• eBooks
  21C Publishing Making an eBook Interoperability Publishing on Kindle Legal Deposit Use of Photographs Print on Demand Short Walk eBooks
• Linux
  Project Log Distros Video Editing Web Video eeePC Agora It just works
• Sustainability
  From E-Waste to E-Resource Imperatives Course E-Waste Recycling Packaging Energy Ratings Environment and ICT ICT Enablers
• About Us
  About Us Contact Us Marghanita da Cruz

No Duty of Care: the Governance of ICT

• This paper draws on two conferences the author was invited to speak at in May 2008. The slides for these presentations are at
  ICT in Corporate Governance - the Australian Experience, Malaysian Corporate Governance Conference, 15-16 May 2008 and
  No Duty of Care: the Governance of ICT ET GOVICT2008, Canberra.
• This paper has also been published in GovNeteJl 3; (2008) 2(1) GovNet eJournal 19
• About the Author: Marghanita da Cruz is the Principal Consultant and Director of Ramin Communications. Between 2002 and 2005, Marghanita was a member of the working group which drafted AS8015 The Australian Standard for Corporate Governance of ICT. She was the founding chair of the Australian Computer Society's Governance of ICT Committee between 2003 and 2006, during which time she represented the Society on Standards Australia's IT Governance and Management Technical Committee (which was responsible for the publication of AS8015-2005). In 2005, she established the ICT Governance Forum Mailing List.

The use of ICT is now critical to most organisations. The efficient and effective use of an organisation's financial and human resources and compliance with legal and regulatory requirements are central to good corporate governance. The way ICT is used, that is the governance of ICT has also become a critical part of good governance. However, the use and proposed use of ICT is not always accorded an appropriate duty of care.

The sudden interest in good governance of organisations can be attributed to the collapse of Ansett, HIH and OneTel in Australia and the likes of Worldcom and Enron in the US, which accompanied the demise of the dot.com stock market bubble in 2000.

These large scale corporate failures affect employees, suppliers, customers and stock holders. While in earlier times, stock holders may have been direct investors in the market, compulsory superannuation arrangements have meant that $1.2trillion belonging to almost all the working and retired population is now invested in Australia.¹ .

In response to calls for government regulators to do something, the 2002 Sarbanes-Oxley Act (SOX) was passed in the US and 2004 CLERP 9 Corporate reporting and disclosure² law were introduced in Australia. The intention was for listed companies to be transparent so that investors could make informed decisions about their investments and regulators could monitor activities more effectively.

The Australian Stock Exchange (ASX) also published Principles for Good Corporate Governance Practice in March 2003 and revised them in 2007³ . The annual reports of listed companies have tended to include a Directors' statement

A series of Australian Corporate Governance standards were also published in 2004. These provide guidance on general principles of good corporate governance, Fraud and Corruption Control, Organisational Codes of Conduct, Corporate Social Responsibility and Whistle Blower protection programs.

2000 was not the first failure, nor the last. The IMF attributed in part the 1997 “Asian financial crisis“ to poor governance and called for reform of financial systems “to improve the efficiency of markets, break the close links between business and governments, and ensure that the integration of the national economy with international financial markets is properly segmented.“⁴ The market turmoil caused by sub-prime housing loans in 2008 has resulted in the US government bailing out troubled banks and caused consternation both in the US and elsewhere.

While organisations need to comply with a legal framework, they also need to perform. The ASX and Australian Standards for Corporate Governance recognise this, and reinforce the role and responsibility of directors for the activities of their organisations. This has been reiterated by the Chairman of the Australian Securities and Investment Commission and by the Chairman of the Malaysian Stock Exchange.

"The OECD Security Principles define Ethics as "participants should respect the legitimate interests of others"⁵. The ASX Corporate Governance Principles (2007) Principle 6 is "Promote Ethical and Responsible decision making"⁶ and the Australian Public Service Values state that members of the service should adhere to "the highest ethical standards"⁷. Organisations are also mentioning their own code of ethics in Annual Reports."

In his opening address to a corporate governance conference⁸ , Dato' Yusli Mohamed Yusoff, the CEO of Bursa Malaysia (Malaysian Stock Exchange) called for corporations to appoint strong, trustworthy leaders with a "high degree of personal integrity and courage." He also stated that while the revised Securities exchange Corporate Governance Code included mandatory reporting of corporate social responsibility activities, this was only a base requirement. "Leaders need to take a sustainable view of the environmental and social effects of their company's activities."

He defined “Leadership as not about doing things; it is about doing the right thing.” In his view, the board of directors as leaders of organisations need more than knowledge and ability to manage their companies. They also need to be the driving force in maintaining disciplined culture of good corporate governance, be accountable and prudent stewards.”

This complements the ASX's good governance guidance⁹ which recommend that directors seek access to independent and external professional advice and indemnity insurance.

The inducement or carrot for good governance of listed companies, is that investors are seeking out companies that do the right thing. There are funds such as Australian Ethical Investment, whose charter for investment includes companies involved in renewable energy, health care, education, waste management and food production but avoids those involved in uranium mining, armaments, tobacco and gambling. USD2-3 billion revenue from the Gulf States exploitation of Oil and Gas reserves has created a market for Shariah compliant investment which also excludes companies whose main activities include revenue streams derived from armaments, tobacco and gambling.¹⁰

The rising influence of NGOs in europe has lead to pension funds becoming more concerned about exposure to the effects of negative publicity and consumers, particularly in Australia and Germany reacting negatively to adverse publicity.

ICT is not an innocent bystander in market turmoil. An inadequate Billing system and hype about Telecommunications played their part in the failure of One.Tel. The collapse of long distance carrier Worldcom was the biggest in US Corporate History. The High expectation of financial rewards from investment in ICT was central to the Dot.Com bubble. The bubble saw Venture Capital of USD105.9 billion invested in over 8000 deals in 2000, dropping to less than half that value the following year¹¹.

In 2002, David Murray, the long time and well respected CEO of the Commonwealth Bank, shocked a conference of IT leaders, and made headlines by blaming the US IT community for "single-handedly wrecking the world economy through an over-hyped market which lead to unrealistic investments"¹² .

Along with the public failures, many organisations were facing difficulties in implementing ICT. As part of the Research undertaken to position and scope a standard for governance of ICT, we reviewed published audit reports of failed government IT initiatives, existing standards, frameworks and methodologies and other literature.

We also undertook interviews with a sample of CIO and senior IT Management."

Our research revealed that while project management (monitoring of schedules and costs) had improved, many of the failures could be attributed to the blind faith and optimism of "Business Owners" in achieving benefits from investment in ICT. The dismal failure of Broadscale outsourcing in both the private and public sector is documented in Audit reports and Media articles

The financial and human resources invested in the use of ICT, sometimes over unnecessarily long periods, have a signficant impact on an organisation. The RACV vs UNISYS court battle lasted 10 years¹³. The customs project blew out by $100million and took over 10 years to be realised¹⁴. The cost of redeveloping the Austrade and DCITA Websites blew out by 500%, and NAB wrote off a $409million IT Project¹⁵. More recently, the $1billion Melbourne¹⁶ and $300 million Sydney¹⁷ Public Transport Ticketing projects have been abandoned and are now the subject of wrangling over costs.

The costs themselves, are not the problem. It is when the costs outweigh the benefits and value delivered that questions arise as to whether the investment was warranted, prudently managed and who, if anyone, should be held accountable for the success or failure of the endeavour.

The Australian Standard for Corporate Governance of Information and Communication Technology (AS8015-2005) was published in January 2005. This Standard was adopted, pretty much unchanged, in May 2008 as ISO 38500-2008 The International Standard for Corporate governance of information technology.

AS8015-2005 defines Corporate Governance of Information and Communication Technology (ICT) as the system by which the current and future use of ICT is directed and controlled. It involves evaluating and directing the plans for the use of ICT to support the organization and monitoring this use to achieve plans. It includes the strategy and policies for using ICT within an Organization.

It also positions ICT as a key corporate resource, making Directors responsible for decisions regarding the use of ICT in their organisations. Echoing the ASX recommendations, it recommends that Directors inform themselves and seek advice from a variety of peer Professionals - lawyers, accountants, vendors, IT professionals, senior managers, IT auditors and external consultants..¹⁸

The research undertaken during the drafting of the standard revealed that a number of management standards and methodologies were in wide use. ITIL, standardised as BS15000 and subsequently as ISO 20000 Service Management had been embraced, Project Management via PMBOK or Prince2 was in hand. Many organisations proudly displayed their ISO 9000 certification. CoBIT was used to review ICT projects and security advice was available through ISO/IEC 17799, AS/NZS 7799.2, ACSI 33¹⁹ and subsequently ISO 27000. The OECD published Security of Information Systems and Networks Principles in 2002²⁰ .

Organisations also needed to ensure their use of ICT complied with Regulation and Legislation, which often laged the introduction of a new technology.

Large companies are required to lodge their taxation information electronically and the ATO offered electronic reporting for the GST, to smaller businesses. In 2007, the Federal Government introduced Legislation to make company websites the default mode of providing company reports to share holders. The ASX encourages and facilitates continuous disclosure by making company disclosures available on its website.

Other Compliance requirements for ICT include:

• The Commonwealth Criminal Code Act 1995, Part 10.7 - Computer Offences, legislates against activities such as hacking, unauthorised modification and destruction of data, denial of service and the creation and distribution of viruses, worms and trojans.
• The Telecommunications act has seen a few changes to allow the sell off, of the terrestrial service provider Telstra (formally Telecom) and the Satellite Service Provider AusSat and the licensing of other carriers. New Interception legislation was introduced in 2006.
• The 1992 Broadcasting Services Legislation, which covers Television and Radio licenses has also seen amendments to cover Online Services (1999) and Digital broadcasting & Data-casting in 2000. However, the take up of Digital TV services have been slow and the shutdown date for Analog TV has recently again been revised to 2013²¹ .
• The Privacy Act 1988 and 2000 imposes principle based restriction on the information which can be gathered, stored and its use ²²
• The Spam Act 2003 made it illegal to send, or cause to be sent, unsolicited commercial electronic messages. The Act covers email, instant messaging, SMS and MMS (text and image-based mobile phone messaging) of a commercial nature. It does not cover faxes, internet pop-ups or voice telemarketing.²³
• The Do Not Call Register Act 2006 allows people to nominate private numbers that cannot be called by voice telemarketers. Charities and Political parties are exempt.²⁴
• The Copyright Act was amended in 2004 to meet the requirements of a US Australia Free Trade Agreement.

The Internet provided both opportunities and threats. In 2003, around 30% of Small Business were victims of Online Credit Card Fraud. There are also a variety of Scams²⁵ including - Online auction & sales of non-existant products or services, Fake Domain name renewals, Spam (junk mail) offers - cheap products, promises of wealth – supply bank account, credit card and personal details.

Phishing and card skimming, used to collect authentication data to enable unauthorised transactions emerged as a new tool for fraud. A study carried out on students and staff found that good websites fooled 90% of participants and 23% of participants did not look at the address bar, status bar, or the security indicators.²⁶

ICT also provides wider flexible access to organisational resources. This can result in unauthorised access to information, compromised data or the misuse of resources such as printers, faxes, telephones, email and Internet Browsing. Organisational Policies need to be designed and implemented to complement legislation and meet the organisation's needs. They provide guidance on what is considered appropriate and inappropriate behaviour.

The innovative aspects of ICT, which can contribute so spectacularly to the performance of an organisation are also problematic. The introduction of ICT requires organisations and their business partners to adopt new practices. If the change is not realised, not only the sometimes significant investment in the technology, but also the benefits are lost.

The UK's National Audit Office has noted that delivery of Public Services cannot be risk free. However, the Public Service who is charged with overseeing the planning, implementation and diffusion of these services, particularly those involving ICT, is more risk ignorant than averse, and this was no more obvious than in the large scale ICT Projects it undertook.²⁷

The Australian Standard proposed 6 principles and model for prudently dealing with this uncertainty and risk. In deed, it was noted in feedback on the draft standard, that it fitted any organisational innovation not just that brought about by ICT. The AS/NZS 4360-2004 defintion of Risk is also reiterated. That is the chance of something happening that will have an impact upon objectives. It is measured in terms of consequence and likelihood.

The standard provides six principles that organisations should adopt in dealing with ICT. These are:

1. Establish Clearly Understood Responsibilities for ICT
2. Plan ICT to best support the organisation
3. Acquire ICT validly
4. Ensure that ICT performs well, whenever required
5. Ensure ICT conforms with formal rules
6. Ensure ICT respects human factors

While there has been a focus on risk identification and management, particularly driven by an insurance based risk management approach, it is also emerging that all the risks associated with ICT cannot be identified at the start of a project. In a recent paper, Rice, O'connor, Pierantozzi's ²⁸ identified four broad areas of ICT project uncertainty: Technical, Market, Organisational and Resource.

These four broad areas, of uncertainty. can be aligned with the principles and model proposed in AS8015.

1. Technical – acquisition and conformance principles
2. Market – Plan and Performance principles
3. Organizational – Responsibility and Human Factors principles
4. Resource – Evaluate, Direct and Monitor aspects of the Model.

The standard provides guidance on what is required for good governance of ICT. The successful implementation of ICT, transforms business practices. It changes roles, responsibilities, skills requirements within and between organisations. It has also been shown that Conflict is a signficant factor to the failure of projects²⁹ .

In 2005, an Ontario [Canada] Government review of large-scale Information and Information Technology projects recommended that the “Business transformation needs to be elevated to the same level as that of the thirty Deputy Minsters focused on policy and operations issues, if it is to get the decision-making attention it needs to succeed.” Further that the “Management Board of Cabinet should determine the government's capacity for large IT-driven business transformation and strictly limit the number and size of concurrent projects accordingly.”³⁰

The Ontario task force also found that joint ventures were not as well suited to IT as they are to capital projects, it is difficult to share risk when many aspects of the project are not easily known at the start of the project.

Another study found that across industry sectors, businesses saw the role of ICT as supporting or improving the efficiency of business functions. Where innovation did occur it was opportunistic.³¹ While in the manufacturing sector, opportunities for strategic innovation through ICT may be reduced when ICT responsibilities are distributed through organisations. While aligning or distributing ICT through the business may have provided Managers with a better appreciation of ICT they may not be aware of the strategic importance and contribution of ICT throughout the business.³²

In 2006, following a performance review of ICT, the Queensland Government created a new role of Chief Technology Officer and endorsed the reorientation of CITEC as the Government's technology service provider.⁴³

The centralisation of ICT is not new. However, the role of ICT has changed and as discussed above compliance is not sufficient to ensure the realisation of the most benefit from ICT investment. The requirement to do so is that leaders and organisations engage in the right activities. AS8015 explicitly mentions professional guidelines and ethics in relation to Principle 5 Ensure ICT conforms with formal rules.

• Directors should regularly evaluate the extent to which ICT satisfies internal obligations including legislation, internal policies, standards and professional guidelines.”
• Directors should direct that ICT staff follow the guidelines set by their professions.
• Directors should direct that all actions relating to ICT be ethical.

In their 2003 analysis of the failure of HIH et al, Clarke and Dean³³ raked over the failures and called for more than simply shaming of the culprits. They bemoaned the practice of equating of corporate governance with ethics. They referred to the labelling of the Auditors, in this case, as demostrating "Bad ethical behaviour", as simply replacing the inept CEOs of previous crashes, as the time-honoured scapegoat.

Legal action and imprisonment of senior officers, followed the US and Australian corporate failures of 2000. A company director's duty of care extended to include the commercial implications of their actions such as Achieving the efficient conduct of their business; setting strategy that management can work towards; safeguarding the assets of the company to whom they are responsible; and providing an environment where instances of material fraud and error are not present” ³⁴

Many annual reports now include a Directors' response to the ASX's good governance recommendations as a reflection of their approach to business. Some annual reports have also mentioned significant ICT projects being undertaken. However, the reporting on ICT has been superficial and rather than discussing, the risks, uncertainty or the benefits, were mentioned as though any investment in ICT should be considered a positive performance indicator.

There has been some discussion about the scope of Professional ethics in ICT. In Ethics³⁵ , Mike Bowern looks at whether the system developer may have contributed to the difficulty a Centrelink client has in resolving a human data entry error and getting their correct payment. He concludes that in the complex system individuals should not be held responsible for problems with the overall system.

In Building ethics into quality assurance³⁶, Craig McDonald's categorisation of stakeholders is interesting. He sees a distinction between the interests of the project team - "professional conduct of the project and for meeting the needs of the team members" and those of the business owner - who is "expecting a benefit or return." for the Organisation.

This hands off – no responsibility role of ICT Professionals is echoed in the HREOC findings of the 2000 SOCOG case, when they found “The only remaining matter is that raised by the respondent namely that any discriminatory conduct in respect of the web site was not that of the respondent but that of its contractor IBM and there has been no complaint against IBM. The web site is the respondent's site. It has engaged within its organisation a person who is identified as the person in charge of its information technology.”³⁷

In ICT Integrity: bringing the ACS code of ethics up to date³⁸ , the authors note that only 20% percent of people working in the ICT are members of the ACS. They go onto argue, that even expulsion from the society would not be seen as a barrier to working in the field.

Pye and Warren³⁹ conclude the ACS Code of Ethics (2003) is about individual behaviour whereas the standard provides advice for organisations. Such Codes of ethics, may be superflous and could undermine or confict with corporate codes of ethics.

In the ICT Industry itself new ethics and values have emerged - notably from the Free Software movement. The open and free software movement challenges the licensing models, central to traditional ICT. "To use free software is to make a political and ethical choice asserting the right to learn, and share what we learn with others. Free software has become the foundation of a learning society where we share our knowledge in a way that others can build upon and enjoy."⁴⁰

Or the Meritocracy of the group developing the Open Source Apache Web Server - “When the group felt that the person had "earned" the merit to be part of the development community, they granted direct access to the code repository, thus increasing the group and increasing the ability of the group to develop the program, and to maintain and develop it more effectively.”⁴¹

Parallels are often drawn to Lawyers, Accountants and Doctors. However, the obvious similarity is to that of well established Mechanical or Civil engineer or even Architect who need to communicate often intangible concepts in order to create tangible outcomes. Lessons on professional indemnity taken from Engineering and Building⁴² also seem more relevant to ICT.

When it comes to ICT, there are rarely precedents or a well troden paths to follow. The risk and uncertainty of a project or even ongoing operation of an ICT system needs to be undertaken within responsible ethical environmental, safety, capability and financial limits – “the computer” cannot continue to be blamed. Nor are Protracted court cases over responsibility or footing the bill for abandoned ICT projects a desirable outcome either.

The author would like to acknowledge the support of the Australian Computer Society, input from members of the Society and numerous others which informed and enabled the drafting and publication AS8015-2005, and Tom Cleary for his comments on this article.

www.ramin.com.au/itgovernance/nodutyofcare-the-governance-of-ict.html last updated 2 November 2019. © Ramin Communications. Privacy Policy. Terms of Use.